FCRT decrypt invalid offset - da freeboot a retail

[xboxbs]

Premesse: non possiedo dump originario (fatta da altro modder), ma andando xell ho annotato cpukey e dumpato (vedi foto sotto)
-Ho letto questo [url]http://www.consoleopen.com/forum/tutorial-base-per-installazione-dellrgh/12664-tutorial-ricreare-la-nand-retail-per-possessori-di-rgh-senza-dump-originale.html[/url]
-Ho letto [url=http://team-xecuter.com/forums/showthread.php?t=92607]How to recover from losing NAND (but have ECC written)[/url]

Situazione attuale:
dopo aver scritto la retail creata da jrunner: la console boota, schermo nero, i led in alto a sinistra del joypad e del ring sono verdi, ma c'è anche un simpatico led rosso ogni 2 secondi.

La console è una trinity 320gb - LDV pari (6 effe sul fuseset07)

Log xebuild jrunner con errore alla voce fcrt

base path changed to D:\J-Runner\xeBuild
---- { Image Build Mode } ----
building retail image
<enter> key on completion suppressed
data directory overridden from command line to '16547\'
per build directory overridden from command line to 'data\'
file name overridden from command line to 'D:\J-Runner\------------\updflash.bin'

------ parsing user ini at 'data\options.ini' ------
loading file...done!
pre-parsing and sanitizing
done!
User options.ini loaded, 0x1b1 bytes in memory
loading cpukey.txt from data\cpukey.txt
CPU Key set to: MIA NONNA (weight:0x35 valid; ecd: valid)
setting 1blkey from ini: MIO NONNO
1BL Key set to : MIO ZIO sum: 0x983 (expects: 0x983)
xex Key set to : MIA ZIA sum: 0x800 (expects: 0x800)

------ parsing ini at '16547\_retail.ini' ------
ini version 16547

ini: label [trinitybl] found
found (1) 'cba_9231.bin' crc: 0x4b0905b0
found (2) 'cbb_9231.bin' crc: 0x444f1df3
found (3) 'cd_9231.bin' crc: 0xcf9ff4c9
found (4) 'ce_1888.bin' crc: 0xff9b60df
found (5) 'cf_16547.bin' crc: 0xa54f9efc
found (6) 'cg_16547.bin' crc: 0xc34c06ed
ini dictates dual CB for this model

ini: label [flashfs] found
found (1) 'aac.xexp' crc: 0xf2808dc5
found (2) 'bootanim.xex' crc: 0xd5c63122
found (3) 'createprofile.xex' crc: 0xf7e474ef
found (4) 'dash.xex' crc: 0x2a153493
found (5) 'deviceselector.xex' crc: 0x09e04596
found (6) 'gamerprofile.xex' crc: 0x4647565d
found (7) 'hud.xex' crc: 0xa6f9c197
found (8) 'huduiskin.xex' crc: 0x1d296f10
found (9) 'mfgbootlauncher.xex' crc: 0x33d5771b
found (10) 'minimediaplayer.xex' crc: 0x4de56d9c
found (11) 'nomni.xexp' crc: 0x97cadcec
found (12) 'nomnifwk.xexp' crc: 0xc7ab2e5b
found (13) 'nomnifwm.xexp' crc: 0x22253a42
found (14) 'SegoeXbox-Light.xtt' crc: 0xe0ee6049
found (15) 'signin.xex' crc: 0xaffe7f78
found (16) 'updater.xex' crc: 0xf6e1cdd5
found (17) 'vk.xex' crc: 0xb916846b
found (18) 'xam.xex' crc: 0x027463e8
found (19) 'xenonclatin.xtt' crc: 0xd5d17ff5
found (20) 'xenonclatin.xttp' crc: 0x7a507ad1
found (21) 'xenonjklatin.xtt' crc: 0xdde4a14c
found (22) 'xenonjklatin.xttp' crc: 0xe2adddfb
found (23) 'ximecore.xex' crc: 0xa86f3ef4
found (24) 'ximedic.xex' crc: 0x1d992bfb
found (25) 'ximedic.xexp' crc: 0x186d8df9

ini: label [security] found
found (1) 'crl.bin' crc: 0x00000000
found (2) 'dae.bin' crc: 0x00000000
found (3) 'extended.bin' crc: 0x00000000
found (4) 'fcrt.bin' crc: 0x00000000
found (5) 'secdata.bin' crc: 0x00000000
------ ini parsing completed ------

output name overridden to: D:\J-Runner\------------\updflash.bin

1BL RSA pub key file is not available, signature checks will not be performed
PIRS RSA pub key file is not available, signature checks will not be performed
MASTER RSA pub key file is not available, signature checks will not be performed

------ Checking data\nanddump.bin ------
data\nanddump.bin file size: 0x1080000
nanddump header checks passed OK!
Loading NAND dump (0x1080000 bytes)...done!
Detecting NAND controller type from dump data...
NAND dump is from a small block machine
NAND dump uses big block controller
parsing dump into user and spare...
done!
decrypting KeyVault at address 0x4000 of size 0x4000
keyvault decrypted OK, will use if no kv.bin is provided
decrypting SMC at address 0x1000 of size 0x3000
SMC decrypted OK, will use if no external smc.bin is provided
seeking smc config in dump...found at offset 0xf7c000! Using if no smc config is provided.
CF slot 0 decrypted ok LDV 0x06 Pairing: 0x4f586b
setting pairing data from image to 0x4f586b
pairing set to: 4f 58 6b
LDV was already set to 6
MobileB.dat found at block 0x387, page 0x0 (page 0x70e0), size 2048 (0x800) bytes
MobileC.dat found at block 0x388, page 0x0 (page 0x7100), size 512 (0x200) bytes
MobileD.dat found at block 0x389, page 0x0 (page 0x7120), size 2048 (0x800) bytes
MobileE.dat found at block 0x38a, page 0x0 (page 0x7140), size 2048 (0x800) bytes
Statistics.settings found at page 0x7bc0, size 4096 (0x1000) bytes
Manufacturing.data found at page 0x7bc0, size 4096 (0x1000) bytes
seeking FSRoot...fsroot found at block 0x38b, page 0x0 (page 0x7160) raw offset 0x7160
seeking security files...
crl.bin found in sector 0x380 size 0xa00...verified! Will use if external file not found.
dae.bin found in sector 0x381 size 0xad30...verified! Will use if external file not found.
extended.bin found in sector 0x384 size 0x4000...verified! Will use if external file not found.

fcrt.bin found in sector 0x385 size 0x4000...pub key to verify signature is not available, skipping!
**** ERROR: FCRT decrypt invalid offset!
verify failed! Discarding data.

secdata.bin found in sector 0x386 size 0x400...verified! Will use if external file not found.
done!
Writing initial header to flash image

------ loading system update container ------
16547\su20076000_00000000 found, loading...done!
Read 0xb35000 bytes to memory
checking integrity...
header seems valid, version 2.0.16547.0
header hash is OK, checking content hashes...
content hashes seem OK, everything looks good!
extracted SUPD\xboxupd.bin (0x7a010 bytes)
decrypting SUPD\xboxupd.bin\CF_16547.bin (0x4560 bytes)...done!
decrypting SUPD\xboxupd.bin\CG_16547.bin (0x75aac bytes)...done!

------ Loading bootloaders and required security files ------
reading data\SMC.bin (0x3000 bytes)
reset smc load address to 0x1000 size 0x3000
reading data\KV.bin (0x4000 bytes)
reading .\common\cba_9231.bin (0x2000 bytes)
loaded cba_9231.bin, could not check signature rsa key not present!
reading .\common\cbb_9231.bin (0x7a30 bytes)
reading .\common\cd_9231.bin (0x5080 bytes)
reading .\common\ce_1888.bin (0x5606a b pad 0x56070 b)
extracted SUPD\xboxupd.bin\CF_16547.bin (0x4560 bytes)
extracted SUPD\xboxupd.bin\CG_16547.bin (0x75aac bytes)
reading data\smc_config.bin (0x10000 bytes)
-------------------
checking smc_config
-------------------
extracting config
valid SMC config data found at offset 0xc000
------------------
SMC config info:
------------------
Target temps: Cpu: 82øC Gpu: 78øC Edram: 76øC
Max temps : Cpu: 89øC Gpu: 82øC Edram: 82øC
Cpu Fan : (auto)
Gpu Fan : (auto)
MAC Address : 7c:ed:8d:95:6f:94
AVRegion : 0x00000300 (PAL50)
GameRegion : 0x02fe (PAL/EU)
DVDRegion : 2
resetKey : YYDD
---------------------
Checking for smc config data patches
smc config was not patched
---------------------
could not check signature of cba_9231.bin, 1BL RSA key not present!
done!
patch slot offset reset to: 0x70000

------ Encrypting and finalizing bootloaders ------
encoding SMC.bin size 0x3000
SMC checksum: f9c96639
known clean SMC found, type: Trinity v5.1(3.01)
known/clean SMC binary found!
encoding KV.bin size 0x4000
decrypted keyvault has been set for reference
Master RSA pub not available, not checking hash
encoding cba_9231.bin size 0x2000
encoding cbb_9231.bin size 0x7a30
CB 9231 seq 0x0304000d type: 0x03 cseq: 0x04 allow: 0x000d
expected fuses:
fuseset 00: C0FFFFFFFFFFFFFF
fuseset 01: 0F0F0F0F0F0FF0F0
fuseset 02: 000F000000000000 (sequence)
fuseset 02: F000000000000000 (allow cseq 1)
fuseset 02: 00F0000000000000 (allow cseq 3)
fuseset 02: 000F000000000000 (allow cseq 4)
**dual CB flag detected!**
**15572+ CBB crypto method detected!**
encoding cd_9231.bin size 0x5080
encoding ce_1888.bin size 0x56070
encoding xell-gggggg.bin size 0x0
encoding cf_16547.bin size 0x4560
encoding cg_16547.bin size 0x75ab0
encoding patches_trinity.bin size 0x0
done!

------ Adding bootloaders to flash image ------
adding SMC.bin at raw offset 0x00001000 len 0x3000 (end 0x4000)
adding KV.bin at raw offset 0x00004000 len 0x4000 (end 0x8000)
adding cba_9231.bin at raw offset 0x00008000 len 0x2000 (end 0xa000)
adding cbb_9231.bin at raw offset 0x0000a000 len 0x7a30 (end 0x11a30)
adding cd_9231.bin at raw offset 0x00011a30 len 0x5080 (end 0x16ab0)
adding ce_1888.bin at raw offset 0x00016ab0 len 0x56070 (end 0x6cb20)
retail image, skipping xell-gggggg.bin
adding cf_16547.bin at raw offset 0x00070000 len 0x4560 (end 0x74560)
adding cg_16547.bin at raw offset 0x00074560 len 0x75ab0 (end 0x80000, rest in fs)
retail image, skipping patches_trinity.bin
Fixing up FS table...done!
Writing zeropair CG patch slot overflow data to sysupdate.xexp1
at raw offset 0x90000 len 0x0006a010 (end: 0x000fa010)...done!

------ adding 25 firmware files ------
extracted SUPD\aac.xexp (0x14000 bytes) (crc32: 0xf2808dc5 ini: 0xf2808dc5)
adding as aac.xexp1 at raw offset 0xfa010 len 0x00014000 (end 0x0010e010)
extracted SUPD\bootanim.xex (0x61000 bytes) (crc32: 0xd5c63122 ini: 0xd5c63122)
adding as bootanim.xex at raw offset 0x110000 len 0x00061000 (end 0x00171000)
extracted SUPD\createprofile.xex (0xc000 bytes) (crc32: 0xf7e474ef ini: 0xf7e474ef)
adding as createprofile.xex at raw offset 0x171000 len 0x0000c000 (end 0x0017d000)
extracted SUPD\dash.xex (0x598000 bytes) (crc32: 0x2a153493 ini: 0x2a153493)
adding as dash.xex at raw offset 0x180000 len 0x00598000 (end 0x00718000)
extracted SUPD\deviceselector.xex (0xa000 bytes) (crc32: 0x09e04596 ini: 0x09e04596)
adding as deviceselector.xex at raw offset 0x718000 len 0x0000a000 (end 0x00722000)
extracted SUPD\gamerprofile.xex (0x1b000 bytes) (crc32: 0x4647565d ini: 0x4647565d)
adding as gamerprofile.xex at raw offset 0x722000 len 0x0001b000 (end 0x0073d000)
extracted SUPD\hud.xex (0x1d000 bytes) (crc32: 0xa6f9c197 ini: 0xa6f9c197)
adding as hud.xex at raw offset 0x73f000 len 0x0001d000 (end 0x0075c000)
extracted SUPD\huduiskin.xex (0x14000 bytes) (crc32: 0x1d296f10 ini: 0x1d296f10)
adding as huduiskin.xex at raw offset 0x75d000 len 0x00014000 (end 0x00771000)
extracted SUPD\mfgbootlauncher.xex (0x8000 bytes) (crc32: 0x33d5771b ini: 0x33d5771b)
adding as mfgbootlauncher.xex at raw offset 0x774000 len 0x00008000 (end 0x0077c000)
extracted SUPD\minimediaplayer.xex (0xc000 bytes) (crc32: 0x4de56d9c ini: 0x4de56d9c)
adding as minimediaplayer.xex at raw offset 0x77c000 len 0x0000c000 (end 0x00788000)
extracted SUPD\nomni.xexp (0xc800 bytes) (crc32: 0x97cadcec ini: 0x97cadcec)
adding as nomni.xexp1 at raw offset 0x788000 len 0x0000c800 (end 0x00794800)
extracted SUPD\nomnifwk.xexp (0x2000 bytes) (crc32: 0xc7ab2e5b ini: 0xc7ab2e5b)
adding as nomnifwk.xexp1 at raw offset 0x794800 len 0x00002000 (end 0x00796800)
extracted SUPD\nomnifwm.xexp (0x5000 bytes) (crc32: 0x22253a42 ini: 0x22253a42)
adding as nomnifwm.xexp1 at raw offset 0x79a000 len 0x00005000 (end 0x0079f000)
extracted SUPD\SegoeXbox-Light.xtt (0x6000 bytes) (crc32: 0xe0ee6049 ini: 0xe0ee6049)
adding as SegoeXbox-Light.xtt at raw offset 0x7a1000 len 0x00006000 (end 0x007a7000)
extracted SUPD\signin.xex (0x19000 bytes) (crc32: 0xaffe7f78 ini: 0xaffe7f78)
adding as signin.xex at raw offset 0x7aa000 len 0x00019000 (end 0x007c3000)
extracted SUPD\updater.xex (0x7000 bytes) (crc32: 0xf6e1cdd5 ini: 0xf6e1cdd5)
adding as updater.xex at raw offset 0x7c5000 len 0x00007000 (end 0x007cc000)
extracted SUPD\vk.xex (0xb000 bytes) (crc32: 0xb916846b ini: 0xb916846b)
adding as vk.xex at raw offset 0x7cf000 len 0x0000b000 (end 0x007da000)
extracted SUPD\xam.xex (0x253000 bytes) (crc32: 0x027463e8 ini: 0x027463e8)
adding as xam.xex at raw offset 0x7db000 len 0x00253000 (end 0x00a2e000)
extracted nanddump\xenonclatin.xtt (0x11b000 bytes) (crc32: 0xd5d17ff5 ini: 0xd5d17ff5)
adding as xenonclatin.xtt at raw offset 0xa2f000 len 0x0011b000 (end 0x00b4a000)
extracted SUPD\xenonclatin.xttp (0x18000 bytes) (crc32: 0x7a507ad1 ini: 0x7a507ad1)
adding as xenonclatin.xttp1 at raw offset 0xb4b000 len 0x00018000 (end 0x00b63000)
extracted nanddump\xenonjklatin.xtt (0x1a8000 bytes) (crc32: 0xdde4a14c ini: 0xdde4a14c)
adding as xenonjklatin.xtt at raw offset 0xb64000 len 0x001a8000 (end 0x00d0c000)
extracted SUPD\xenonjklatin.xttp (0x7000 bytes) (crc32: 0xe2adddfb ini: 0xe2adddfb)
adding as xenonjklatin.xttp1 at raw offset 0xd0c000 len 0x00007000 (end 0x00d13000)
extracted SUPD\ximecore.xex (0x17000 bytes) (crc32: 0xa86f3ef4 ini: 0xa86f3ef4)
adding as ximecore.xex at raw offset 0xd13000 len 0x00017000 (end 0x00d2a000)
extracted nanddump\ximedic.xex (0x90000 bytes) (crc32: 0x1d992bfb ini: 0x1d992bfb)
adding as ximedic.xex at raw offset 0xd2b000 len 0x00090000 (end 0x00dbb000)
extracted SUPD\ximedic.xexp (0x2800 bytes) (crc32: 0x186d8df9 ini: 0x186d8df9)
adding as ximedic.xexp1 at raw offset 0xdbc000 len 0x00002800 (end 0x00dbe800)

------ adding 5 security files ------
<- Processing crl.bin ->
reading data\crl.bin (0xa00 bytes)
crl appears crypted, attempting to decrypt with CPU key...failed! Trying alternate key...success!
adding as crl.bin at raw offset 0xdc0000 len 0x00000a00 (end 0x00dc0a00)

<- Processing dae.bin ->
reading data\dae.bin (0xad30 bytes)
dae appears encrypted, attempting to decrypt with CPU key...failed! Attempting to decrypt with alternate key...
success!
adding as dae.bin at raw offset 0xdc4000 len 0x0000ad30 (end 0x00dced30)

<- Processing extended.bin ->
reading data\extended.bin (0x4000 bytes)
adding as extended.bin at raw offset 0xdd0000 len 0x00004000 (end 0x00dd4000)

<- Processing fcrt.bin ->
reading data\fcrt.bin (0x4000 bytes)
**** ERROR: FCRT encrypt invalid offset!
adding as fcrt.bin at raw offset 0xdd4000 len 0x00004000 (end 0x00dd8000)

<- Processing secdata.bin ->
reading data\secdata.bin (0x400 bytes)
adding as secdata.bin at raw offset 0xdd8000 len 0x00000400 (end 0x00dd8400)

------ checking for Mobile*.dat ------
MobileB.dat found, adding from previous parse
adding MobileB.dat as type 0x31 at raw offset 0xddc000 len 0x800 (end 0xddc800)
MobileC.dat found, adding from previous parse
adding MobileC.dat as type 0x32 at raw offset 0xde0000 len 0x200 (end 0xde0200)
MobileD.dat found, adding from previous parse
adding MobileD.dat as type 0x33 at raw offset 0xde4000 len 0x800 (end 0xde4800)
MobileE.dat found, adding from previous parse
adding MobileE.dat as type 0x34 at raw offset 0xde8000 len 0x800 (end 0xde8800)
Statistics.settings found, adding from previous parse
adding Statistics.settings at raw offset 0xf78000 len 0x1000 (end 0xf79000)
Manufacturing.data found, adding from previous parse
adding Manufacturing.data at raw offset 0xf74000 len 0x1000 (end 0xf75000)

------ adding smc_config.bin ------
adding smc config to offset 0x00f7c000, len 0x400

------ finalizing image ------
Fixing up empty FS block entries...done!
Writing FS table to image offset 0xdec000 len 0x4000 (end 0xdf0000)...done!
fixing up big block controller on small block NAND LBA numbers...done!
calculating ECD bytes and assembling raw image...done!
done remapping!

------ writing image to disk ------
writing file 'D:\J-Runner\------------\updflash.bin' to disk...done!
---------------------------------------------------------------
D:\J-Runner\------------\updflash.bin image built, info:
---------------------------------------------------------------
Kernel : 2.0.16547.0
Console : Trinity
NAND size : 16MiB
Build : Retail
Serial : ------------
ConsoleId : ------------
MoboSerial: ----------------
Mfg Date : 06/24/2011
CPU Key : --------------------------------
1BL Key : --------------------------------
DVD Key : --------------------------------
CF LDV : 6
KV type : type2 (hashed - unchecked, master key not available)
---------------------------------------------------------------
xeBuild Finished. Have a nice day.
---------------------------------------------------------------

CB Trinity
9188 1
9230 3
9231 4


1) come risolvo l'errore fcrt?
2) non ho ancora capito come si fa a capire quale sia la dash giusta da usare per fare la nand retail (si parte dal fuseset 02 giusto?)

L'obiettivo è togliere rgh, mettere una retail funzionante e poi xkey.

Thanks

[xboxbs]

sia con cb 9188 dash 14699
che con cb 9230 dash 14717

dopo 25 secondi led rosso fisso

cb 9231 dash 16547 la console boota, led verdi come da foto, niente a video e poi led rosso intermittente (ogni 2 secondi)

[PlayerOne]

in base al CB controlla le dash che corrispondono (ce ne sono più di una per ogni CB e c'è una tabella che puoi consultare) e provale una ad una. Quando mi capitano richieste simili io faccio così, perchè anch'io sinceramente non ho capito come si fa ad identificare la dash giusta.

EDIT: mmmm quindi il CB che montava l'istante prima che venisse moddata non si sa di preciso? però se cmq hai trovato la giusta combinazione che la fa bootare se già a buon punto... chissà però a cosa è dovuto quel comportamento, mai visto fino ad oggi.

[The Pusher]

Per me la nand che c'e' onboard e' gia' un reimpasto con una donor.

[xboxbs]

Avviata per la prima volta con un freeboot e opzione no fcrt . E rimarrà così.